v2.33.0 — Safety hardening + drift cleanup

Theme: Safety hardening — hard_deny tier + defensive facet parsing + drift cleanup

Highlights

• Hard_deny tier on top of branch-guard: third unconditional protection layer (force-push to main, .git deletion, gh repo delete, ~/.claude wipe — survives all session bypasses)
• Defensive parsing in /craft:hub and /craft:do so corrupt facet files no longer crash the commands
• Production safety leak fixed in branch-guard.sh: new files under non-existent dirs were silently bypassing protection on main and dev
• Eliminated 4 phantom mismatches that surfaced on every /craft:site:update (badge_syncer false positives)
• First v2.33.0 spec increment: /craft:check --version validator (Insights-Driven Improvements)
• 5 issues closed: #126 (insights spec), #127 (badge_syncer), #134 (branch-guard leak), #135 (BSD sed), #136 (skill paths)

Tests

• 1638 passed, 5 skipped (env-conditional), 1 xfail
• Zero regressions across all v2.33.0 work

Issues closed

• #126 docs: env-var → stdin contract drift in insights spec
• #127 badge_syncer: dual-row + docs-shields false positives
• #134 fix: branch-guard.sh path canonicalization production leak
• #135 fix: docs-staleness-check.sh BSD-sed bug (silent no-op on macOS)
• #136 docs: 19 stale skill paths in skills-agents.md

Issues filed for follow-up

• #133 hard_deny criterion #5 e2e gap (blocked on Claude Code exposing classifier hook)
• #130 himalaya-mcp + nexus-cli App secrets (needs user UI work)
• #108 Tauri/cask workflow revamp (large feature scope)

Deferred

• v2.33.0 Increments 2-4 (Worktree pre-flight, Homebrew SHA fix, Sweep --fix) — bundled into a future release

Full changelog: see CHANGELOG.md